3ÔÂ29ÈÕÍí£¬£¬×¯ÏÐÓÎÏ·Çå¾²Ó¦¼±ÏìÓ¦ÖÐÐļà²âµ½Spring Framework¸ßΣԶ³Ì´úÂëÖ´ÐÐÎó²î£¬£¬²¢µÚһʱ¼ä¾ÙÐÐÎó²î¸´ÏÖ£¬£¬Ëæ¼´Æô¶¯Ó¦¼±ÏìÓ¦£¬£¬ÊµÊ±±¨ËÍÎó²îÐÅÏ¢¡£¡£¡£ÏÖÔÚ£¬£¬¹ú¼ÒÐÅÏ¢Çå¾²Îó²î¹²Ïíƽ̨£¨CNVD£©ÒÑÊÕ¼Spring FrameworkÔ¶³ÌÏÂÁîÖ´ÐÐÎó²î£¨CNVD-2022-23942£©£¬£¬²¢ÖÂл¡£¡£¡£

ÏÖÔÚ£¬£¬×¯ÏÐÓÎÏ·ÏÂÒ»´ú·À»ðǽ¡¢Å³ÈõÐÔɨÃèÓëÖÎÀíϵͳ¡¢×Ô˳ӦÇå¾²·ÀÓùϵͳ¡¢WebÓ¦ÓÃÇå¾²·À»¤ÏµÍ³¡¢µÈ²úÆ·¾ùÒѸüÐÂSpring FrameworkÔ¶³ÌÏÂÁîÖ´ÐÐÎó²î¼ì²é»ò·À»¤²å¼þ£¬£¬½¨ÒéÓû§¾¡¿ì¸üйæÔò¿â£¬£¬ÊµÊ±²éȱ²¹Â©£¬£¬Ïû³ýΣº¦¡£¡£¡£

Îó²îÐÅÏ¢

ÊÜÓ°Ïì°æ±¾ÐÅÏ¢ÈçÏ£º

SpringFramework 5.3.X < 5.3.18

SpringFramework 5.2.X < 5.2.20

ÒÔ¼°ÈκÎÒýÓÃSpringFrameworkµÄÑÜÉú²úÆ·£¬£¬ÈçJDK ¡Ý 9£¬£¬JRE ¡Ý 9

Îó²î´¦Öóͷ£

Spring¹Ù·½´¦Öóͷ£¼Æ»®

ÏÖÔÚ£¬£¬Spring¹Ù·½ÒÑÐû²¼Ð°汾Íê³ÉÎó²îÐÞ¸´£¬£¬CNVD½¨ÒéÊÜÎó²îÓ°ÏìµÄ²úÆ·£¨Ð§ÀÍ£©³§É̺ÍÐÅϢϵͳÔËÓªÕß¾¡¿ì¾ÙÐÐ×Բ飬£¬²¢ÊµÊ±Éý¼¶ÖÁ×îа汾£º

https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement

ׯÏÐÓÎϷųÈõÐÔɨÃèÓëÖÎÀíϵͳ

ׯÏÐÓÎϷųÈõÐÔɨÃèÓëÖÎÀíϵͳ¼¯³Éϵͳ©ɨ¡¢Web©ɨ¡¢Êý¾Ý¿â©ɨ¡¢Èõ¿ÚÁî¼ì²â¡¢»ùÏߺ˲éµÈ¹¦Ð§£¬£¬¿É´Ó¶à½Ç¶È¾ÙÐÐÐÅÏ¢×ʲúµÄųÈõÐÔÉó¼Æ£¬£¬ÌṩרҵµÄÇå¾²ÆÊÎöºÍÐÞ²¹½¨Òé¡£¡£¡£×¯ÏÐÓÎϷ©ɨÒÑÐû²¼½ôÆÈÉý¼¶°ü£¬£¬¸üС¢¼ì²âÒªÁìÈçÏ£º

1¡¢ÊÖ¶¯Éý¼¶·½·¨£º¹æÔò¿âÉý¼¶ÖÁ¡°vas-sys-v1.0-2022.04.01.tir¡±ºÍ¡°vas-web-v2022.04.01.tir¡±°æ±¾£¬£¬¿ÉÁªÏµ×¯ÏÐÓÎÏ·ÍâµØÊÖÒÕÖ°Ô±»ñÈ¡×îйæÔò¿â
£»£»

2¡¢ÔÚÏß×Ô¶¯Éý¼¶£ºÊ¹ÓÃÖÎÀíÔ±Õ˺š¾ÏµÍ³ÖÎÀí¡¿¡ú¡¾ÏµÍ³Î¬»¤¡¿¡ú¡¾²å¼þ¿âÉý¼¶¡¿¡úÁ¬Ã¦Éý¼¶
£»£»

3¡¢½¨ÉèÎó²îɨÃèʹÃü£ºÉ¨ÃèÍê³ÉºóÉó²é±¨¸æ£¬£¬Èç±£´æ¸ÃÎó²î£¬£¬¿Éƾ֤±¨¸æÖеÄÐÞ¸´½¨Òé¾ÙÐС°²¹È±¡±¡£¡£¡£

ׯÏÐÓÎÏ·×Ô˳ӦÇå¾²·ÀÓùϵͳ

ׯÏÐÓÎÏ·×Ô˳ӦÇå¾²·ÀÓùϵͳ¼¯·ÀÓù¡¢¼ì²â¡¢ÏìÓ¦¡¢Õ¹ÍûΪһÌ壬£¬Í¨¹ý×ʲúÖÎÀí¡¢Î£º¦·¢Ã÷¡¢Íþв¼à²â¡¢ÍøÂç΢¸ôÀëµÈ¹¦Ð§ÊµÏÖÒ»Á¬µÄ¼à¿ØÓëÆÊÎö£¬£¬¾«×¼¶¨Î»Ö÷»úÐÂÎó²î£¬£¬ÔöÇ¿×Ô¶¯·ÀÓùÄÜÁ¦¡£¡£¡£Îó²î¶¨Î»Óë´¦Öóͷ£·½·¨ÈçÏ£º

1¡¢ ͨ¹ý×ʲúÇåµã¶ÔSpring Framework¾ÙÐÐÅŲ飬£¬µÚһʱ¼ä¶¨Î»Î£º¦Ö÷»ú
£»£»

2¡¢¶ÔΣº¦Ö÷»úÏ·¢Îó²îɨÃèʹÃü£¬£¬Èô±£´æ¸ÃΣº¦Îó²î£¬£¬¿Éƾ֤ÐÞ¸´½¨Òé¾ÙÐÐÎó²îÐÞ¸´¡£¡£¡£

ׯÏÐÓÎÏ·WebÓ¦ÓÃÇå¾²·À»¤ÏµÍ³

ׯÏÐÓÎÏ·WebÓ¦ÓÃÇå¾²·À»¤²úÆ·£¨TopWAF£©ÄÚÖÃÇå¾²¹æÔò²¢Á¬Ïµ×Ôѧϰ£¬£¬×Ô¶¯»¯¹¥»÷·À»¤¡¢Îó²îɨÃè¡¢DDoS·À»¤¡¢ÍøÒ³·À¸Ä¶¯µÈ¹¦Ð§£¬£¬¶ÔWebÓªÒµµÄË«ÏòÁ÷Á¿¾ÙÐÐÇå¾²¹ýÂË£¬£¬Îª¿í´ó¿Í»§ÌṩÖÇÄÜ¡¢¸ßЧ¡¢Áã¸ÐÖªµÄWebÇå¾²½â¾ö¼Æ»®¡£¡£¡£

ÒÑ°²ÅÅׯÏÐÓÎÏ·TopWAF¿Í»§ÔÚ2021Äê3ÔÂÖ®ºó¸üйý¹æÔò¿â¶¼¿ÉÒÔ·ÀÓù¸ÃÎó²î£¬£¬È·ÈÏ¿ªÆô·À»¤¹æÔòID£º1030006¼´¿É
£»£»

1¡¢ÅÌÎʹæÔò¿â°æ±¾£º¡¾ÏµÍ³ÖÎÀí¡¿¡ú¡¾ÏµÍ³Î¬»¤¡¿¡ú¡¾¹æÔò¿âÉý¼¶¡¿
£»£»

2¡¢È·ÈÏ¿ªÆô·À»¤¹æÔò£º¡¾Web·À»¤¡¿¡ú¡¾Çå¾²Õ½ÂÔ¡¿¡ú¡¾¹æÔò¿â¡¿¡ú¡¾½¹µã¹æÔò¡¿ËÑË÷ID£º1030006 Éó²éÆôÓÃ״̬
£»£»

3¡¢Éó²é×èµ²ÐÅÏ¢£º¡¾¼à¿ØÖÐÐÄ¡¿¡ú¡¾Çå¾²²ßÈÕÖ¾¡¿¡ú¡¾¹¥»÷ÈÕÖ¾¡¿¡£¡£¡£